1Claw connector for Muse

# 1Claw Muse Connector

The 1Claw connector for [Meta Muse](https://muse.ai). Muse users get their AI agents'
approval queue, wallets and activity inside Muse — "is anything waiting on me?",
"approve that", "what did my agents do today?" — while 1Claw keeps every credential,
guardrail and audit trail exactly where it was.

Muse builds **Custom Connectors** by [retrieving a service's API information and storing the
user's credential in its Secure Credentials Store](https://www.meta.com/help/artificial-intelligence/1687253048996149/).
This package is that API: a small, plain-spoken REST surface (`/openapi.json`, `/llms.txt`) in
front of the [1Claw Platform API](https://docs.1claw.co/docs/platform-api/overview), plus the
link flow that turns a signed-in 1Claw user into a scoped, revocable connector token.

```
Muse ──(mcn_ token)──▶ muse.1claw.co ──(plt_ key + connection id)──▶ api.1claw.co
                      this service                                   1Claw vault
```

## What a Muse user can do

| Ask Muse | Route | Notes |
|---|---|---|
| "Is anything waiting on me?" | `GET /v1/approvals` | Both queues (consensus + agent action approvals), one shape |
| "Approve that" / "No, reject it" | `POST /v1/approvals/{id}/decide` | The only write. Consensus votes echo the `payload_hash` the connector read, never one Muse supplies |
| "How much is in my agents' wallets?" | `GET /v1/portfolio`, `GET /v1/balances` | Only wallets on agents the user granted to Muse |
| "What did my agents do today?" | `GET /v1/activity` | Delegation log for the connection |
| "What jobs do they run?" | `GET /v1/automations` | Read only |
| "Which account is this?" | `GET /v1/me` | Connection + granted resources |

Not possible through this connector, by design: reading secrets, moving funds, creating or
changing agents or policies. Those stay in the 1Claw dashboard.

## How a user connects (once)

1. Signed in to 1Claw, go to **Settings → Connected Apps → Connect Muse** (1claw.co/connect/muse). The page calls `POST /v1/link` on this
   service with the user's session; the service asks the vault who they are and creates (or finds)
   their connection on the 1Claw-owned **Muse** platform app. An existing 1Claw user goes through
   the standard "Sign in with 1Claw" link consent once.
2. The user chooses which **agents** Muse may see (the connected-apps grant flow — a connection with
   n